Chapter 1
An Introduction to Mobile Device Security
AntĂłnio Lima, Pedro Borges, Bruno Sousa, Paulo SimĂľes, and Tiago Cruz
Contents
1.1Introduction
1.2Security Risks and Open Challenges
1.2.1Evolution of Mobile Device Complexity
1.2.2Information Risks
1.2.3Threat Taxonomy
1.2.4Case Studies on Security Threats in Mobile Devices
1.3Fundamental Concepts
1.3.1Device Security and Application Security
1.3.2Consumer vs. Corporate Environments
1.3.3Stakeholders
1.3.4Mobile Device and Application Management
1.3.5Security Life Cycle for Mobile Devices
1.3.5.1Prevention
1.3.5.2Monitoring
1.3.5.3Mitigation
1.3.5.4Analysis and Comparison
1.4Mobile Device and Application Management
1.4.1Remote Deployment of Security Policies
1.4.2Dedicated Application Stores
1.4.3Remote Device Control
1.4.4Remote Application Deployment
1.5Security Hardening and Preventive Techniques
1.5.1Application Development Aspects
1.5.1.1Data Protection
1.5.1.2Resource Usage
1.5.1.3Event Management
1.5.1.4Exploits and Malicious Applications, Devices, or Users
1.5.2Security Policies
1.5.3Official Secure Application Stores
1.5.4Operating Systems Recommendations
1.5.5Data Storage
1.5.6Authentication
1.5.7Isolation and Trust
1.5.7.1Virtualization
1.5.7.2Trusted Execution Environment
1.6Monitoring, Detection, and Reaction
1.6.1Monitoring
1.6.2IDS and IDPS (Detection and Reaction)
1.7Conclusion
References
1.1Introduction
This chapter provides a state-of-the-art overview regarding available solutions and best practices for mobile device and mobile application security. It provides a broad perspective of the security aspects involved in mobile applications, encompassing the whole ecosystem (user, operator, operating system, mobile application, and user and application data). Besides providing guidelines and best practices for the development of secure mobile applications, it also includes information on how to apply such solutions in Android and iOS mobile operating systems.
This chapter includes several techniques that can be applied by different players, including application developers (to design and develop secure mobile applications) and administrators of corporate systems (to enforce security policies on mobile devices). The myriad of uses for mobile devices raises security threats that require solutions involving the full chain: device manufactures (e.g., Samsung), services providers (e.g., Google with Play Store), applications developers, and consumers (end-users). As such, a broad perspective is required encompassing the design and development of secure mobile applications, including selection of appropriate platforms (operating systems, mobile devices, telco support, mobile device management frameworks), best practices for developing secure mobile applications, and a clear understanding of the different stakeholdersâ roles in provisioning secure mobile applications. For instance, consumers need to understand the risks associated with different uses of their mobile device(s), and corporations need to provide adequate security mechanisms for their devices or for the devices owned by consumers but employed for professional activitiesâin line with the Bring Your Own Device (BYOD) paradigm, which extends the possibilities of mobile device use even in mission-critical scenarios [33], but leads to issues regarding the management of security by corporations.
Several security approaches can be pursued to prevent attacks (e.g., installation of malware), to monitor the behavior of applications and use of mobile devices (e.g., applications sending frequent data to remote sites without user permission) and to mitigate potential threats (e.g., malware accessing personal data). In particular, the Mobile Device and Application Management (MDAM) frameworks (e.g., Samsung Know, Android for Work) are essential tools for corporate environments, to enforce security policies.
1.2Security Risks and Open Challenges
The increased computing, communications, and interface capabilities have allowed mobile devices to progressively evolve towards becoming diversified digital assistants. Nevertheless, such newly acquired roles have also shown themselves to be a hindrance in terms of security as they have increased the value of the mobile device as a target for attackers.
The motivation for this chapter is many-fold. First, to bring users awareness of the security risks associated with the use of the mobile devices. Second, to provide an introduction to the security mechanisms that can be employed to prevent and mitigate security threats. Third, to highlight how corporations can manage devices and applications running in corporate devices or even accommodate new trends such as Bring Your Own Device, especially in mission critical scenarios such as public protection and disaster relief where security requirements are more stringent. Fourth, to discuss how device manufacturers can design and incorporate secu...